Author Topic: Quake pack from steam showing win32:Junkpoly [cryp]  (Read 5725 times)

0 Members and 1 Guest are viewing this topic.

James45

  • Guest
Quake pack from steam showing win32:Junkpoly [cryp]
« on: April 10, 2008, 08:55:07 PM »
Downloading the quake pack from Steam for some old school fps action but Avast home 4.8 is recognising quake2.exe and other files as junkpoly. Is this a detection error or is the Steam content infected?

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67183
Re: Quake pack from steam showing win32:Junkpoly [cryp]
« Reply #1 on: April 10, 2008, 10:26:54 PM »
To know if a file is a false positive, please submit it to VirusTotal and let us know the result. If it is indeed a false positive, send it in a password protected zip to virus@avast.com
Please, mention in the body of the message why you think it is a false positive and the password used. Thanks.
Other possibility is JOTTI. VirusTotal and Jotti both have file size limit of 10Mb.

As a workaround, you can add these files to the Standard Shield provider (on-access scanning) exclusion list.
Left click the 'a' blue icon, click on the provider icon at left and then Customize. Go to Advanced tab and click on Add button...
You can use wildcards like * and ?. But be careful, you should 'exclude' that many files that let your system in danger.

After that, please, periodically check it - scan it into Chest, right clicking the file -  there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected as being infected then you can also remove it from the Exclusion list.

This link is a tutorial on how to help correct a virus detection that you believe to be false:
http://forum.avast.com/index.php?topic=25009.msg204838#msg204838
or http://forum.avast.com/index.php?topic=7779.msg62586#msg62586
The best things in life are free.

James45

  • Guest

kubecj

  • Guest
Re: Quake pack from steam showing win32:Junkpoly [cryp]
« Reply #3 on: April 10, 2008, 11:38:29 PM »
Are you sure you have the latest vps file? 080410-1. If not, update and rescan. JunkPoly detection was changed multiple times.

James45

  • Guest
Re: Quake pack from steam showing win32:Junkpoly [cryp]
« Reply #4 on: April 10, 2008, 11:44:32 PM »
I update every day so I'd guess so.

EDIT: Just checked and yes I have.
« Last Edit: April 10, 2008, 11:49:31 PM by James45 »

kopeor

  • Guest
Re: Quake pack from steam showing win32:Junkpoly [cryp]
« Reply #5 on: April 11, 2008, 05:35:27 AM »
Most likely related, I have just has the same problem with steam with a couple of files from the full spectrum warrior package.
http://www.virustotal.com/analisis/08f00c551eaeb791e1fc31181b63f7d2

Offline Maxx_original

  • Moderator
  • Super Poster
  • *
  • Posts: 1479
Re: Quake pack from steam showing win32:Junkpoly [cryp]
« Reply #6 on: April 11, 2008, 08:59:11 AM »
got some samples.. the detection should be fixed soon ;)

Enikad

  • Guest
Same issue with Steam, this time its with the Dawn of War: Gold Edition Bundle. I've taken some steps to cure the issue.

Firstly I just tried quarantining the files, then by using steams integrity check, re-installing the damaged components, didn't work right when the new files hit the system avast picked them up as infected with Win32:JunkPoly [Cryp], so dang... this time I deleted all of the infected files, deleted the local content, backed up saved game data. Then restarted steam, attempted to re-install the game. Same thing happened the second the executables were downloaded and installed avast was on them again, infected yet again with Win32:JunkPoly [Cryp], I'm not going to run any other games from steam until its resolved for the moment, I'm still trying to fix it. But the file is re-writting to the executables, luckily avast prevents the action from executing or who knows what trouble i'd be in. In another stroke of luck, windows is isolated on my system from my media drives. So as far as I know it has not made it to the core, ad-aware and avast's scanners are still going. I've cleared my DNS, clears all downloaded content, I'm about to crucify my temp folder, I've delved into the registry trying to find where its re-witting from but a lack of information on the virus is making it difficult. After all the scans are completed and I've cleared out everything, i'm going to attempt to re-install the game again.

I was thinking before attempting a re-install i'd try this http://forum.avast.com/index.php?topic=33345.0 the hijack-this whatever operation. Not sure what it is and would like more info.

I'm fairly convinced at this point that the problem is on Steam's end. My system has run 100% virus/adware/spyware/malware free for 2 years with avast, spyware, and adware's help. However currently no firewall other than the router is active. So yea if anyone has their firewall information from when these viruses hit I'd like to know what firewall you had; I stopped using ZA because of the amount of processing power it consumed, and how invasive it is to the system, even with it off it's still controlling the systems downstreams, and upstreams.

I'm not in a position to reformat this machine, so I'm going to do my best to fix it.

This thread was perfect because I'm experiencing identical problems.

The main fault here is I have NO INFORMATION on this virus/worm, its target, what its designed to do, or its method of entry or activation. A couple hours of searching the web kept bringing me back here.

EDIT: More info>>> Avast Fully Updated, VPS current to the day. AD-Aware Personal SE was used in inital scans, replaced with ad-aware 2007 after scan, fully updated re-scanned nothing but cookies, spybot search and destroy, again yielded nothing but cookies. All temp folders cleaned, new entries to the registry in the last 16 hours were researched, and were just system processes.

I removed the files from the system so If they're still infected when the game is re-installed I'll document it. However my last attempt to email the file to AVAST failed "Completed with Errors" as it said.

AVAST is re-scanning now after modifications. Going to attempt re-install of steam content after completion will update post then.

If I seem insane here, probably am a little, very paranoid about my systems.

EDIT 2: Cleaned up, removed all infected files full system scan. Went to re-install the game, and sure enough, all executables even before they were done downloading were flagged. So yea if its a false positive I'll wait for the VPS update. And if its a real threat I'll keep my files quarantined, and copies of my system data and attempted fixes in an archive to send to avast.

« Last Edit: April 11, 2008, 11:36:49 AM by Enikad »

Offline Maxx_original

  • Moderator
  • Super Poster
  • *
  • Posts: 1479
Re: Quake pack from steam showing win32:Junkpoly [cryp]
« Reply #8 on: April 11, 2008, 12:01:51 PM »
update your VPS and check the files again ;)

Enikad

  • Guest
Re: Quake pack from steam showing win32:Junkpoly [cryp]
« Reply #9 on: April 11, 2008, 12:55:18 PM »
VPS Updated successfully, all scans repeated on infected files. Infected files restored, programs executed with no complications, full system scan after that reveals all clear.

Good job, and thanks.

James45

  • Guest
Re: Quake pack from steam showing win32:Junkpoly [cryp]
« Reply #10 on: April 11, 2008, 10:10:35 PM »
Brilliant, talk about quick response! :o